diff --git a/advisories/github-reviewed/2024/07/GHSA-52cw-pvq9-9m5v/GHSA-52cw-pvq9-9m5v.json b/advisories/github-reviewed/2024/07/GHSA-52cw-pvq9-9m5v/GHSA-52cw-pvq9-9m5v.json new file mode 100644 index 00000000000..ab6b17d171b --- /dev/null +++ b/advisories/github-reviewed/2024/07/GHSA-52cw-pvq9-9m5v/GHSA-52cw-pvq9-9m5v.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-52cw-pvq9-9m5v", + "modified": "2024-07-17T16:00:48Z", + "published": "2024-07-17T16:00:48Z", + "aliases": [ + + ], + "summary": "Silverstripe uses TinyMCE which allows svg files linked in object tags", + "details": "### Impact\nTinyMCE v6 has a configuration value `convert_unsafe_embeds` set to `false` which allows svg files containing javascript to be used in `` or `` tags, which can be used as a vector for XSS attacks.\n\nNote that `` tags are not allowed by default.\n\nAfter patching the default value of `convert_unsafe_embeds` will be set to `true`. This means that `` tags will be converted to iframes instead the next time the page is saved, which may break any pages that rely upon previously saved `` tags. Developers can override this configuration if desired to revert to the original behaviour.\n\nWe reviewed the potential impact of this vulnerability within the context of Silverstripe CMS. We concluded this is a medium impact vulnerability given how TinyMCE is used by Silverstripe CMS.\n\n### References:\n- https://www.silverstripe.org/download/security-releases/ss-2024-001\n- https://github.com/advisories/GHSA-5359-pvf2-pw78\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "silverstripe/framework" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.2.16" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-52cw-pvq9-9m5v" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-5359-pvf2-pw78" + }, + { + "type": "PACKAGE", + "url": "https://github.com/silverstripe/silverstripe-framework" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1395", + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-07-17T16:00:48Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/07/GHSA-vmcp-66r5-3pcp/GHSA-vmcp-66r5-3pcp.json b/advisories/github-reviewed/2024/07/GHSA-vmcp-66r5-3pcp/GHSA-vmcp-66r5-3pcp.json new file mode 100644 index 00000000000..ab1ca921c86 --- /dev/null +++ b/advisories/github-reviewed/2024/07/GHSA-vmcp-66r5-3pcp/GHSA-vmcp-66r5-3pcp.json @@ -0,0 +1,125 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vmcp-66r5-3pcp", + "modified": "2024-07-17T16:00:11Z", + "published": "2024-07-17T16:00:10Z", + "aliases": [ + "CVE-2024-40636" + ], + "summary": "Steeltoe Leaks Basic Auth Credentials to Logs After Fetch Registry Error", + "details": "### Summary\nWhen utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked.\n\n### Details\nPackage: Steeltoe.Discovery.Eureka\nPackage version: 3.2.1\nBranch: \"release/3.2\"\nFile name: `DiscoveryClient.cs`\nLine number: 325\nCode in question: `_logger.LogError(e, \"FetchRegistry Failed for Eureka service urls: {EurekaServerServiceUrls}\", new Uri(ClientConfig.EurekaServerServiceUrls).ToMaskedString());`\n\n\nError message in logs: `FetchRegistry Failed for Eureka service urls: https://****:****@eureka1.com:443/eureka,https://user:password@eureka2.com:443/eureka`\n\nI thought `new Uri(clientOptions.EurekaServerServiceUrls)` would throw a `UriFormatException` since there are multiple URLs but my logs are showing two URLs regardless.\n\n### PoC\n1. Set Eureka config with multiple server URLs with basic auth\n2. Apologies for not being more descriptive for this step, but I believe we would just need to trigger an exception in `FetchFullRegistryAsync`.\n3. Check the logs and should see the error \n\n### Impact\nVulnerability: Credential leakage in the logs\nWho does it impact?: Users who are using peer awareness with Spring Eureka", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "NuGet", + "name": "Steeltoe.Discovery.Eureka" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.8" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.2.7" + } + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Steeltoe.Discovery.EurekaBase" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.5.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Steeltoe.Discovery.ClientCore" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 3.0.0" + } + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Steeltoe.Discovery.ClientAutofac" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.5.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-vmcp-66r5-3pcp" + }, + { + "type": "WEB", + "url": "https://github.com/SteeltoeOSS/Steeltoe/commit/c5d4a94e90ccb77f8e851bc681a2e348a95e7ecb" + }, + { + "type": "PACKAGE", + "url": "https://github.com/SteeltoeOSS/security-advisories" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-07-17T16:00:10Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-w799-v85j-88pg/GHSA-w799-v85j-88pg.json b/advisories/github-reviewed/2024/07/GHSA-w799-v85j-88pg/GHSA-w799-v85j-88pg.json similarity index 54% rename from advisories/unreviewed/2024/07/GHSA-w799-v85j-88pg/GHSA-w799-v85j-88pg.json rename to advisories/github-reviewed/2024/07/GHSA-w799-v85j-88pg/GHSA-w799-v85j-88pg.json index f6a684dee23..d66c539890d 100644 --- a/advisories/unreviewed/2024/07/GHSA-w799-v85j-88pg/GHSA-w799-v85j-88pg.json +++ b/advisories/github-reviewed/2024/07/GHSA-w799-v85j-88pg/GHSA-w799-v85j-88pg.json @@ -1,26 +1,53 @@ { "schema_version": "1.4.0", "id": "GHSA-w799-v85j-88pg", - "modified": "2024-07-17T03:31:38Z", + "modified": "2024-07-17T16:01:10Z", "published": "2024-07-17T03:31:38Z", "aliases": [ "CVE-2024-6535" ], + "summary": "Skupper uses a static cookie secret for the openshift oauth-proxy", "details": "A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the openshift oauth-proxy with a static cookie-secret. In certain circumstances, this may allow an attacker to bypass authentication to the Skupper console via a specially-crafted cookie.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/skupperproject/skupper" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.0-20240703184342-c26bce4079ff" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6535" }, + { + "type": "WEB", + "url": "https://github.com/skupperproject/skupper/commit/d2cb3782e807853694ee66b6e3d4a1917485eb71" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-6535" @@ -28,6 +55,10 @@ { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2296024" + }, + { + "type": "PACKAGE", + "url": "https://github.com/skupperproject/skupper" } ], "database_specific": { @@ -35,8 +66,8 @@ "CWE-1392" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-07-17T16:01:10Z", "nvd_published_at": "2024-07-17T03:15:01Z" } } \ No newline at end of file